Control statement
- a.Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems:
- 1.Are developed and maintained;
- 2.Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
- 3.Are reported in accordance with established reporting requirements.
- b.Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
Discussion
The plan of action and milestones is a key organizational document and is subject to reporting requirements established by the Office of Management and Budget. Organizations develop plans of action and milestones with an organization-wide perspective, prioritizing risk response actions and ensuring consistency with the goals and objectives of the organization. Plan of action and milestones updates are based on findings from control assessments and continuous monitoring activities. There can be multiple plans of action and milestones corresponding to the information system level, mission/business process level, and organizational/governance level. While plans of action and milestones are required for federal organizations, other types of organizations can help reduce risk by documenting and tracking planned remediations. Specific guidance on plans of action and milestones at the system level is provided in [CA-5](#ca-5).
From control text to operational evidence
Use Plan of Action and Milestones Process as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to enterprise program governance, accountability, resources, metrics, and organization-wide risk decisions.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- program charters and policies
- governance meeting records
- risk and performance metrics
- resource and responsibility assignments
Common failure patterns
- program metrics count activity instead of outcomes
- system-level risks never reach enterprise governance
- responsibilities assigned without authority or resources
- privacy and security managed in separate silos
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- PM-04a.
- PM-04a.01
- PM-04a.01[01]a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed;
- PM-04a.01[02]a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained;
- PM-04a.01[03]a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed;
- PM-04a.01[04]a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained;
- PM-04a.01[05]a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed;
- PM-04a.01[06]a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained;
- PM-04a.02
- PM-04a.02[01]a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
- PM-04a.02[02]a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
- PM-04a.02[03]a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
- PM-04a.03
- PM-04a.03[01]a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
- PM-04a.03[02]a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
- PM-04a.03[03]a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
- PM-04a.01
- PM-04b.
- PM-04b.[01]plans of action and milestones are reviewed for consistency with the organizational risk management strategy;
- PM-04b.[02]plans of action and milestones are reviewed for consistency with organization-wide priorities for risk response actions.
Examine
- Information security program plan
- plans of action and milestones
- procedures addressing plans of action and milestones development and maintenance
- procedures addressing plans of action and milestones reporting
- procedures for reviewing plans of action and milestones for consistency with risk management strategy and risk response priorities
- results of risk assessments associated with plans of action and milestones
- OMB FISMA reporting requirements
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for developing, maintaining, reviewing, and reporting plans of action and milestones
- organizational personnel with information security responsibilities
Test
- Organizational processes for plan of action and milestones development, review, maintenance, and reporting
- mechanisms supporting plans of action and milestones
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.